ext/session: fix cookie_lifetime overflow - #21704
Merged
Girgias merged 5 commits intoApr 20, 2026
Merged
Conversation
When session.cookie_lifetime was set to a value larger than maxcookie, OnUpdateCookieLifetime returned SUCCESS without updating the internal long value, causing ini_get() string and PS(cookie_lifetime) to go out of sync. Now the value is properly clamped to maxcookie with both the string and internal long updated consistently, and a warning is emitted.
Girgias
reviewed
Apr 10, 2026
Girgias
left a comment
Girgias
left a comment
Member
There was a problem hiding this comment.
While at it could you fix the way we parse the string as well? As this probably allows non numeric strings and float strings.
jorgsowa
marked this pull request as ready for review
April 11, 2026 09:43
Girgias
reviewed
Apr 13, 2026
Girgias
left a comment
Girgias
left a comment
Member
There was a problem hiding this comment.
Getting there, minor comments. Thanks for tackling this :)
Girgias
reviewed
Apr 14, 2026
Comment on lines
723
to
729
| } else if (lval > maxcookie) { | ||
| php_error_docref(NULL, E_WARNING, "session.cookie_lifetime must be between 0 and " ZEND_LONG_FMT ", value clamped to maximum", maxcookie); | ||
| zend_long *p = ZEND_INI_GET_ADDR(); | ||
| *p = maxcookie; | ||
| entry->value = zend_long_to_str(maxcookie); | ||
| return SUCCESS; | ||
| } |
Member
There was a problem hiding this comment.
I think it was a bug before for it to return SUCCESS, so I would rather have it return FAILURE and warn then silently change behaviour.
Effectively just change the prior if condition to if (lval < 0 || lval > maxcookie) {
Contributor
Author
There was a problem hiding this comment.
Sure. It changes logic and may break some implementations, but it's fine to me.
Girgias
reviewed
Apr 14, 2026
| if (oflow != 0) { | ||
| php_error_docref(NULL, E_WARNING, "session.cookie_lifetime must be between 0 and " ZEND_LONG_FMT, maxcookie); | ||
| } else { | ||
| php_error_docref(NULL, E_WARNING, "session.cookie_lifetime must be an integer"); |
Member
There was a problem hiding this comment.
The usual error message is something along the line of must be of type int.
Contributor
Author
There was a problem hiding this comment.
Applied + created an addition to CODING_CONVENTIONS.md in #21761
jorgsowa
force-pushed
the
fix/session-cookie-lifetime-overflow
branch
from
April 14, 2026 21:36
b99050e to
83991b6
Compare
Girgias
approved these changes
Apr 20, 2026
jordikroon
added a commit
to jordikroon/php-src
that referenced
this pull request
Apr 21, 2026
* master: (26 commits) Fix usage of optimize attribute on unsupported compilers (phpGH-21819) PHP 8.4 is now for PHP 8.4.22-dev ext/phar: remove `phar_archive_data->alias == phar_archive_data->fname` checks (php#21820) [skip ci] Mark curl/bug71523.phpt as online test [skip ci] Sort paths-ignore and remove cirrus [skip ci] Tweak paths-ignore ext/standard: Throw a ValueError when the parameter includes NUL bytes in `putenv` and `getenv` (php#21817) ext/session: fix missing zval_ptr_dtor for retval in PS_GC_FUNC(user) [skip ci] Backport CI changes ext/gmp: reject values larger than unsigned long in gmp_pow/binomial/root/rootrem and shift/pow operators. Update NEWS for recent bug fixes ext/phar: Fix memory leak in phar_verify_signature() when md_ctx is invalid phar: propagate phar_stream_flush return value from phar_stream_close phar: call phar_entry_delref before goto finish in phar_add_file error paths phar: free is_temp_dir entry before rejecting .phar/* paths in offsetGet phar: fix NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent phar: restore is_link handler in phar_intercept_functions_shutdown ext/session: improve parsing of session.cookie_lifetime (php#21704) /ext/standard: Check for empty string in linkinfo() (php#21793) [Windows] Improve clang-cl support (php#21618) ...
Girgias
pushed a commit
that referenced
this pull request
May 24, 2026
adrian-enspired
pushed a commit
to adrian-enspired/php-src
that referenced
this pull request
Aug 4, 2026
When session.cookie_lifetime was set to a value larger than maxcookie, OnUpdateCookieLifetime returned SUCCESS without updating the internal long value, causing ini_get() string and PS(cookie_lifetime) to go out of sync. We now properly parse the string value of the ini setting and fail when it is not an integer string or is not within the expected range.
adrian-enspired
pushed a commit
to adrian-enspired/php-src
that referenced
this pull request
Aug 4, 2026
Add NEWS entries for three ext/session changes that were never documented: - SameSite cookie validation (phpGH-21670) - session.cookie_lifetime improved parsing (phpGH-21704) - Recursive GC cleanup for nested session directories (phpGH-21491)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
session.cookie_lifetimewas set to a value larger than maxcookie,OnUpdateCookieLifetimereturned SUCCESS without updating the internal long value, causing ini_get() string and PS(cookie_lifetime) to go out of sync.Now the value is properly clamped to maxcookie with both the string and internal long updated consistently, and a warning is emitted.
Edit:
Added validation of value of maxcookie, only numeric strings are allowed.